What is the CVSS score of CVE-2025-61022?

CVE-2025-61022 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of OpenLink Virtuoso are affected by CVE-2025-61022?

OpenLink Virtuoso Open Source Edition v7.2.11 contains a remotely-triggered, unauthenticated denial of service vulnerability that can crash the database engine, with no public exploit identified at…

How to fix or mitigate CVE-2025-61022?

24 hours: Inventory all systems running OpenLink Virtuoso v7.2.11 and assess network exposure from untrusted networks. 7 days: Implement firewall rules restricting database port access to authorized internal networks only; enable query rate limiting and comprehensive logging of SQL statements. 30 days: Execute upgrade plan to migrate to OpenLink Virtuoso v7.2.12 or later (once released), or transition to an actively maintained alternative database platform.

OpenLink Virtuoso CVE-2025-61022

EUVD-2025-210317 HIGH

SQL Injection (CWE-89)

2026-06-23 mitre

GHSA-r7w2-7c95-6pj5

Denial Of Service SQLi Red Hat N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable SQL listener with low complexity, but Virtuoso typically authenticates SQL sessions so PR:L; only availability impacted.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 19:00 vuln.today

CVSS changed

Jun 23, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jun 23, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

AnalysisAI

Denial of service in OpenLink Virtuoso Open Source Edition v7.2.11 allows remote attackers to crash the database engine by submitting crafted SQL statements that mishandle column predicate processing inside the sqlo_tb_col_preds query optimizer component. CVSS 7.5 reflects high availability impact with no authentication required, though no public exploit identified at time of analysis and the issue is tracked only as an upstream GitHub bug report.

Technical ContextAI

Virtuoso is a multi-model hybrid RDBMS from OpenLink Software combining relational SQL, RDF/SPARQL, and column store engines, commonly used as a triple store and SPARQL endpoint. The vulnerable sqlo_tb_col_preds routine sits inside the SQL optimizer (sqlo = SQL optimizer) and is responsible for evaluating column-level predicates while building a query plan for a table reference. Although the CWE is recorded as CWE-89 (Improper Neutralization of Special Elements in an SQL Command), the observable behavior - a process-killing crash from malformed SQL - is more characteristic of an unchecked-input or null-pointer/assertion failure in the optimizer than classic injection, so the CWE tag likely reflects the SQL-parsing surface rather than data exfiltration via injected queries.

RemediationAI

No vendor-released patch identified at time of analysis; the only public artifact is the upstream issue at https://github.com/openlink/virtuoso-opensource/issues/1226, so administrators should monitor that ticket and the openlink/virtuoso-opensource repository for a tagged release that fixes sqlo_tb_col_preds and upgrade as soon as one is published. Until a fix lands, compensating controls include placing the Virtuoso SQL listener (default TCP 1111) behind a firewall or VPN so only trusted clients can submit SQL, disabling anonymous/SPARQL-update access on the /sparql endpoint via the SPARQL_UPDATE role configuration (side effect: read-write SPARQL clients break), enforcing strong SQL_USER authentication and removing the default dba/dba credentials, and adding a supervisor or systemd auto-restart for the virtuoso-t process to limit downtime if a crash is triggered (side effect: masks repeated abuse, so pair with logging).